The Data Act opens access to machine data
The EU Data Act gave equipment users a stronger route to the data needed by independent maintenance and analytics services, with important limits on access and reuse.
A factory can own a connected machine without having an easy route to its operating data. That gap matters when an independent maintenance provider wants to diagnose a fault, or when software needs to compare performance across equipment from several manufacturers. The European Union's Data Act introduced rules intended to change that relationship.
The framework established rights to access, use and share data; it did not assign all machine data to the equipment purchaser. It gave users of connected products a route to relevant data and the ability to request sharing with a third party. For industrial startups, it created a more concrete basis for an aftermarket service, while leaving substantial work between a legal entitlement and a useful diagnosis.
The timetable mattered to the installed base
The regulation generally applied from 12 September 2025. Article 50 separately scheduled the obligation to design products and related services for accessible data under Article 3(1): it applied to connected products and related services placed on the market after 12 September 2026. An existing machine did not have to acquire a newly designed interface simply because the main application date had arrived.
- 11 January 2024
Entry into force
The regulation establishes the framework and its staged application.
- 12 September 2025
General application
User access and sharing provisions apply, subject to the regulation's scope and exceptions.
- After 12 September 2026
Product design obligation
Article 3(1) applies to connected products and related services placed on the market after this date.
Regulation (EU) 2023/2854, Articles 3 and 50, sets separate stages for entry into force, general application and product design requirements.
Source1
Existing equipment could still be covered by the access provisions. Where the user could not directly access the data, Article 4 required the data holder to make readily available data accessible under specified conditions. Implementation required two kinds of preparation: manufacturers needed to examine what they could already obtain, while future product development also had to address accessibility by design. These were related projects with different starting points.
A service starts with an authorised request
The Act allowed a user, or a party acting on its behalf, to request that a data holder make readily available data and necessary metadata available to a third party. Sharing had to be without undue delay and of the same quality available to the holder, in a structured, commonly used and machine-readable format. Continuous access in real time was qualified by relevance and technical feasibility.
For a maintenance startup, the process began with identifying the user and the equipment covered by its authority. A service agreement needed to establish the task for which the data would be used and how access would continue when machinery changed hands or the engagement ended. The recipient's obligations included respecting the agreed purpose and deleting data no longer needed for it, with qualifications for agreements concerning non-personal data. The service needed a way to manage these permissions.
Useful data needs engineering context
A stream of temperature readings may be uninterpretable without units, sampling intervals, sensor locations and knowledge of the machine's operating state. The regulation's express inclusion of metadata recognised part of this problem. It did not guarantee that data from different manufacturers would share the same vocabulary or that a maintenance model trained on one installation would work at another. The cost of integration and validation still mattered to the business.
The Commission identified independent repair and maintenance, industrial efficiency and agricultural operations as potential uses. Access made those uses possible, but each service still needed evidence of its operational value. A startup could demonstrate its value on a defined equipment class by showing how data changed a maintenance decision. Counting connected assets or ingested records would say less about the service than proving that its recommendations were timely, understandable and useful to the operator.
Sharing rights came with boundaries
Trade secrets remained protected. The Act required proportionate measures to preserve confidentiality, with procedures for withholding, suspending or, in exceptional circumstances, refusing particular disclosures. It also preserved personal data protection law. A dataset about industrial equipment could still contain information about identifiable workers, so a contractual request from the equipment user did not automatically settle every data protection question.
Users and recipients could not use the obtained data to develop a connected product competing with the product from which it came. That restriction was distinct from offering a competing maintenance or other aftermarket service, which was central to the policy's purpose. A company needed to describe its actual output carefully: improving a customer's operation, training a general model and developing rival hardware could involve different questions. Broad claims to unrestricted reuse would weaken the business case.
Young companies could sit on either side
The same startup might receive data for an analytics service and hold data generated by its own connected equipment. Article 7 excluded qualifying micro and small enterprises from the chapter's obligations to share data, with conditions concerning linked businesses and subcontracting; medium-sized enterprises also had limited transitional treatment. A company needed to assess those conditions as well as its size to determine whether a product or service was covered.
Cost also depended on the relationship. Access and requested sharing were free to the user, but a business data recipient could face reasonable, non-discriminatory compensation under the rules for mandatory sharing. For qualifying SME recipients, compensation was limited to specified costs of making the data available. A forecast that treated every external dataset as free would miss this distinction. Contracts needed to identify the payer, the calculation and the work included in the charge.
From data access to a useful service
The practical opening was a service able to work across a customer's installed equipment with fewer contractual barriers. That could strengthen independent diagnostics or maintenance software, particularly where a customer previously depended on one manufacturer's tools. Yet the user still needed secure installation, dependable data transfer and advice that fitted the operating environment. A right to receive data did not supply domain expertise or acceptance by the people responsible for a production line.
A service needed to produce a recurring operational benefit. That might mean prioritising inspections, explaining abnormal behaviour or helping staff compare assets. Each claim would need evidence from the relevant setting. The Act improved the legal basis for those services; their defensibility still depended on implementation quality, accumulated engineering knowledge and a customer relationship that outlasted the first data connection.
Investment implications
- A service provider's access depended on the user's right to request data.
- An accessible dataset still needed metadata, engineering context and a permitted purpose.
- Rights to access data took effect before the obligation to design new products for accessible data.
Sources
- Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act) (opens in a new tab)
Official Journal of the European Union
- EU Data Act gives users control over data from connected devices (opens in a new tab)
European Commission
Published
